# Help/Advice needed setting up geo-ip filters in an on-prem Logstash to SIEM in Elastic Cloud instance

**URL:** https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593
**Category:** Logstash
**Created:** [May 20, 2021, 11:51pm UTC](https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593 "2021-05-20T23:51:31Z")
**Posts on this page:** 1
**Showing post:** 12

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [May 27, 2021, 5:26am UTC](https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593/12 "2021-05-27T05:26:54Z")

</div>

I ran for a while with

**packetbeat -\> logstash -\> elasticsearch in elastic cloud**

and the data is showing up in the SIEM App

 ![Screen Shot 2021-05-26 at 10.22.12 PM](https://us1.discourse-cdn.com/elastic/original/3X/6/8/686c3ece61135528a2b9efe76e06f8966555dec3.jpeg)

I did notice the map on the Packetbeat dashboard is looking at the map in detail it is looking for `client.geo.location`

**Data source** Clusters and grids

**Index pattern** packetbeat-\*

**Geospatial field** client.geo.location

`client.ip` which my packetbeat on my mac does not fill but I just when to the map and added `destination.geo.location` the showed up on the map.

 ![Screen Shot 2021-05-26 at 10.23.20 PM](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d976b60dce7b3c5886cbd495183fc57ab88a49c.jpeg)

---

_[View the full topic](https://discuss.elastic.co/t/help-advice-needed-setting-up-geo-ip-filters-in-an-on-prem-logstash-to-siem-in-elastic-cloud-instance/273593)._